3,601 reputation
629
bio website
location Netherlands
age 40
visits member for 2 years, 8 months
seen 7 hours ago

Java and security expert with over 10 years of experience with the language and with the practical application of cryptographic protocols - including the design of protocols within international standardization bodies. Creator of a heavily used common criteria certified product. Over 30 years of experience with computers. Likes kids, cats, reading, movies and several sports.


Jun
3
revised Twisted curves in protocol
added 7 characters in body
Jun
3
asked Twisted curves in protocol
Jun
3
comment Is it a requirement to understand mathematics when implementing (or breaking) cryptography?
@rath Well said, but working on a crypto lib is a bit overspecifying things. If you work on algorithm implementations would be better. Even then, there may be reference implementations available. Often it is of more use to have a good understanding on how to implement the ref. implementation on a specific platform (e.g. with regard to memory management) than a clear mathematical understanding of the the underlying primitives.
Jun
3
revised Security of a security protocol for key exchange, using symmetric-key cryptography
Added note
Jun
2
comment Precomputation attacks on RSA
@RickyDemer If you expect a stronger security than the security strength of the underlying hash function (its output size divided by two for an fully secure hash function) then I guess you may be in trouble anyway, precomputation or not. Having the security of a 1024 bit RSA key halved is an entirely different matter.
Jun
2
comment AES/CBC fixed Initial vector use-case
@Seth that's basically the answer. Actually, you could compare prefixes and extract information from that if you have information about what is encrypted. Could you write one up?
Jun
2
comment Security of a security protocol for key exchange, using symmetric-key cryptography
Of course, if $E$ is ECB mode encryption and the nonce is a single block, then all bets are off, but I've made the jump to semantically secure, supplying confidentiality. I've not jumped to authenticated encryption as there is nothing in the question that would suggest such a thing.
Jun
2
answered Security of a security protocol for key exchange, using symmetric-key cryptography
Jun
2
comment Security of a security protocol for key exchange, using symmetric-key cryptography
That the chance that the nonces are equal is small depends entirely on how the nonces are generated, and probably also on the size of the nonce. Otherwise, this scheme looks awfully familiar to some smart card schemes relying on a master key and generating session keys (but not identical).
Jun
2
comment Is RSA key size the size of private key exponent in public key encryption?
Note that I've seen many issues with regard to this, I've seen private key exponents that are two or even three bytes less than the size of the modulus (let alone bits) so please don't rely on the private exponent (or the secret S in ECC keys, as in your other question).
Jun
2
comment Measure ECC key size
No need for that kind of comment, please re-read the question and ask yourself if your answer matches.
Jun
2
comment Measure ECC key size
If you use the private key value $S$ itself (which you shouldn't), then you should definitively not treat it as an integer. There is nothing to prevent the private key to start with 00 or 0000 to my knowledge. So using integer(S).bitlength() or similar may give you the wrong result.
Jun
2
comment Measure ECC key size
Hi new user and welcome. Unfortunately this is in my opinion not what was asked. I guess the question is: "Given a key, what parameter(s) should I use to retrieve the key size?"
Jun
2
revised Which one of the Block Cipher modes is the best?
added link to CMS, added warning for XML encryption without authentication
Jun
2
comment Precomputation attacks on RSA
Yeah, I was hoping that the sheer size of the key space was enough, but I wasn't 100% sure. I presume correctly that it is even harder if not impossible for PSS (given that the implementation is correct, of course)?
Jun
2
accepted Precomputation attacks on RSA
Jun
2
comment Precomputation attacks on RSA
Reading through CCM and wondering if this was not applicable in any of my implementations, could not find info for RSA.
Jun
2
asked Precomputation attacks on RSA
Jun
2
comment Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
Could not find this Q/A using Google. Thomas, should we generate a new question "why is RSA PKCS#1 v1.5 encryption considered broken?". Problem is answer would be more or less identical.
Jun
2
comment Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?
@Steve The verification of OAEP includes checking for a hash value over the random padding which twarts Bleichenbachers attack, at least if OAEP is implemented well (i.e. the verification of the padding is an atomic operation). The likelyhood of the hash over the padding being correct by supplying a chosen ciphertext is of course very small indeed. PS ask separate questions instead of asking for more on a given answer.